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Abstract 

A quantum key distribution protocol based on entanglement swapping is proposed. 
Through choosing particles by twos from the sequence and performing Bell mea- 
surements, two communicators can detect eavesdropping and obtain the secure key. 
Because the two particles measured together are selected out randomly, we need 
neither alternative measurements nor rotations of the Bell states to obtain security. 
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1 Introduction 



As a kind of important resource, entanglement [1] is widely used in the re- 
search of quantum information, including quantum communication, quantum 
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cryptography and quantum computation. Entanglement swapping [2], abbre- 
viated by ES, is a nice property of entanglement. That is, by appropriate 
Bell measurements, entanglement can be swapped between different particles. 
For example, consider two pairs of particles in the state of |$ + ), equivalently, 
|$ + )i2 = |$ + )34 = l/\/2(|00) + 1 11) ) , where the subscripts denote different 
particles. If we make a Bell measurement on I and 3, they will be entan- 
gled to one of the Bell states. Simultaneously, 2 and 4 will be also projected 
onto a corresponding Bell state. We can find the possible results through the 
following process: 

|$ + )l2 ® |$ + >34 = |(|00> + |11»12 ® (|00) + |11»34 

= i(|0000> + |0101) + |1010) + |Hll))i324 

= i(|$ + <l» + ) + |$-$-) + |tf + tf+) + |*-*-))i324 (1) 

It can be seen that there are four possible results: | < ^>" 1 ") 13 1 < ^ > " l ") 2 4, |$~)i3|$~)24i 
|\l/ + )i3|\l/ + ) 2 4 and |^ r_ )i3|^ f_ )24- Furthermore, these results appear with equal 
probability, that is, 1/4. For further discussion about ES, please see Refs. [3,4,5,6]. 

Quantum cryptography is the combination of quantum mechanics and cryp- 
tography. It employs fundamental theories in quantum mechanics to obtain 
unconditional security. Quantum key distribution (QKD) is an important re- 
search direction in quantum cryptography. Bennett and Brassard came up 
with the first QKD protocol (BB84 protocol) in 1984 [7]. Afterwards, many 
protocols were presented [8,9,10,11,12,13,14,15,16,17,18,19,20,21,22]. Recently, 
several QKD schemes based on ES were proposed [23,24,25,26,27,28,29,30]. In 
Refs. [23,24,25] the author introduced a protocol without alternative measure- 
ments. It was simplified [26] and generalized [27] before long, and its security 
was proved in Ref.[28]. Besides, by ES, doubly entangled photon pairs [29] and 
previously shared Bell states [30] can be used to distribute secure key. 

In this Letter we propose a QKD protocol based on ES, which needs nei- 
ther alternative measurements [29] nor rotations of the Bell states [25,26,27]. 
The security against the attack discussed in Ref.[24] is assured by a special 
technique, that is, random grouping (RG). See Sec. 2 for the details of this 
protocol. The security against general individual attack is analyzed in Sec. 3 
and a conclusion is given in Sec. 4. 



2 The QKD protocol 

The particular process of this scheme is as follows: 
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1. Prepare the particles. Alice generates a sequence of EPR pairs in the state 
\$+) AB = 1/^2(100) + |11)). For each pair, Alice stores one particle and sends 
the other to Bob. 

2. Detect eavesdropping. 

(1) Having received all the particles from Alice, Bob randomly selects a set of 
particles out and makes Bell measurements on them by twos. 

(2) Bob tells Alice the sequence numbers and measurement results of the pairs 
he measured. 

(3) According to the sequence numbers, Alice performs Bell measurements on 
the corresponding pairs, and compares her results with Bob's. For example, 
consider one of the pairs Bob measured, in which the sequence numbers of the 
two particles are m and n, respectively. Then Alice measures her m-th and 
ra-th particles in Bell basis, and compares the two outcomes. As discussed in 
Sec.l, if these particles were not eavesdropped, Alice and Bob should obtain 
the same results. With this knowledge, Alice can determine, through the error 
rate, whether there is any eavesdropping. If there are no eavesdroppers in the 
channel, Alice and Bob proceed with the next step. 

3. Obtain the key. Bob makes Bell measurements on his left particles by twos. 
It should be emphasized that each pair he measures is selected out randomly. 
Bob records the sequence numbers of all these pairs and sends the record to 
Alice. Alice then measures her corresponding particles in Bell basis. As dis- 
cussed in the above paragraphs, their measurement results would be identical. 
Subsequently, Alice and Bob can obtain the raw key from these results. For 
example, |$ + ), \&~), \^ + ) and \^~) are encoded into 00, 01, 10 and 11, re- 
spectively. After error correction and privacy amplification [32], the raw key 
will be processed into ideal secret key. 

Thus the whole QKD protocol is finished. By this process, Alice and Bob 
can obtain secure key. In this scheme, we use |$ + ) as the initial state. In 
practice, any other Bell state is competent and the communicators can even 
utilize various states for different pairs. It should be emphasized that, however, 
the various initial states cannot improve the efficiency of QKD (the alleged 
"high efficiency" in Ref. [30] is a mistake [31]). In fact, our protocol works in a 
deterministic manner and then has full efficiency in the sense that one qubit- 
transmission brings one key bit. That is, except for the detection particles, 
the users can obtain 1 bit (raw) key per qubit-transmission in our protocol, 
which is higher than the BB84 protocol (0.5 bit). 

To compare the efficiency of our protocol with that of others deeply, we can 
employ Cabello's definition of QKD efficiency [19]. Let us give a simple exam- 
ple to implement the above protocol and then calculate its efficiency Suppose 
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Alice and Bob deal with four EPR pairs (denoted as pairs 1,2,3,4, respectively) 
in one step. More specifically, Alice sends four particles (each from one of the 
four EPR pairs) to Bob and announces a classical (random) bit (0 or 1) after 
Bob received this group of particles. If the classical bit is 0, they perform ES 
on the pairs 1,3 and 2,4 to obtain the key. Otherwise they perform ES on the 
pairs 1,4 and 2,3. In this example, Alice and Bob get four key bits by trans- 
mitting four qubit and one cbit (classical bit). Obviously, the efficiency equals 
to 0.8, which is relatively higher (For instance, the efficiency of the famous 
protocols in Ref.[9], [7], [11], [8], [13], [23] is < 0.25, 0.25, < 0.33, 0.5, 0.5, 
0.67, respectively. See Table I in Ref.[19] for details). 



3 Security 

The above scheme can be regarded as secure because the key distributed 
can not be eavesdropped imperceptively. There are two general eavesdropping 
strategies for Eve. One is called "intercept and resend" , that is, Eve intercepts 
the legal particles and replaces them by her counterfeit ones. For example, 
Eve generates the same EPR pairs and sends one particle from each pair to 
Bob, thus she can judge Bob's measurement results as Alice does in step 3. 
But in this case there are no correlations between Alice's particles and the 
counterfeit ones. Alice and Bob will get random measurement results when 
they detect eavesdropping in step 2. Suppose both Alice and Bob use s pairs 
to detect eavesdropping, the probability with which they obtain the same re- 
sults is only (l/4) s . That is, Eve will be detected with high probability when 
s is big enough. The second strategy for Eve is to entangle an ancilla with 
the two-particle state that Alice and Bob are using. At some later time she 
can measure the ancilla to gain information about the measurement results of 
Bob. This kind of attack seems to be stronger than the first strategy. However, 
it is invalid to our protocol as we prove below. 

Because each particle transmitted in the channel is in a maximally mixed 
state, there are no differences among all these particles for Eve. Furthermore, 
Eve does not know which two particles Bob will put together to make a Bell 
measurement. As a result, what she can do is to make the same operation on 
each particle. Let \<p)abe denote the state of the composite system including 
one certain EPR pair and the corresponding ancilla, where the subscripts A, 
B and E express the particles belonging to Alice, Bob and Eve, respectively. 
Note that each ancilla's dimension is not limited here, and Eve is permitted 
to build all devices allowed by the laws of quantum mechanics. What we 
want to show is that \^>)abe must be a product of a two-particle state and 
the ancilla if the eavesdropping introduces no errors into the QKD procedure, 
which implies that Eve will gain no information about the key by observing the 
ancilla. Conversely, if gaining information about the key, Eve will invariably 
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introduce errors. 



Without loss of generality, suppose the Schmidt decomposition [33] of \(p)abe 
is in the form 

W)abe = ai\ipi) ab\4>i) E + a>2\i>2) ab\4>2) E 

+a 3 \i) 3 ) ab\^) e + a 4 \^) ab\<Pa) E (2) 

where and \<f>j) are two sets of orthonomal states, are non-negative real 
numbers k = 1, 2, 3, 4 ). 

Because \ipi) are two-particle (four-dimensional) states, they can be written 
as the linear combinations of 1 00) , 1 01) , 1 10) and |11). Let 

l^i) = 6n|00> + 6 12 |01> + 6 13 |10> + 6 14 |11> 
|^ 2 ) = &2i|00) + ftaalOl) + 633 1 10) + & 24 |ii) 
1^3) = 631 100) + 632IOI) + 633IIO) + 634IH) 

|^4) = 641 100) + 642IOI) + 643IIO) + 644IH) (3) 

where b pq (p, q = 1,2, 3, 4) are complex numbers. Then \(p)abe can be written, 
thanks to Eqs.(2) and (3), as 

\<P)abe = \00)ab <S> (ai6n|0i) + a 2 6 2 i|0 2 ) + a 3 6 3 i|0 3 ) + a 4 6 4 i|0 4 ))i? 
+ |01)ab ® (ai&i 2 |0i) + a 2 6 22 |0 2 ) + a 3 6 32 |0 3 ) + a 4 6 42 |0 4 ))i? 
+ |10)ab <S> (ai6i 3 |0i) + a 2 6 23 |0 2 ) + a 3 6 33 |0 3 ) + a 4 & 43 |0 4 ))i? 
+\11)ab <S> (ai6i 4 |0i) + O2&24|02) + a 3 6 34 |0 3 ) + a 4 6 44 |0 4 ))£ (4) 

For convenience, we define four vectors (not quantum states) as follows: 

vi = (ai&u, a 2 b 2 i, a 3 b 3 i, a 4 6 4 /) I = 1, 2, 3, 4 (5) 

Consider any two sets of particles on which Alice and Bob will do ES, the 
state of the system is \(p)abe <8> \<p)abe- According to the properties of ES, we 
can calculate the probability with which each possible measurement-results- 
pair is obtained after Alice and Bob measured their particles in Bell basis. For 
example, observe the event that Alice gets |<3> + ) and Bob gets |^/ + ) , which 
corresponds to the following item in the expansion: 

4 

(arbriask S 2 + a r b r2 a s b sl + a r b r3 a s b s4: + a r b r4 a s b s3 )\(f) r (f) s } E 

r,s=l 



-|$ + >^+> B ® 



Therefore, this event occurs with the probability 
1 4 

P($j^£) = \a r b rl a s b s2 + a r b r2 a s b sl + a r b r3 a s b sA + a r b r4 a s b s3 \ 2 (7) 

4 r,s=l 

However, this event should not occur. In fact, if Eve wants to escape from the 
detection of Alice and Bob, any results-pair other than $ + $ + , ^+^+ 
and \[>~\I>~ should not appear. Let P(Q^b) = 0> we then have, from Eqs.(7) 
and (5), 

v\v 2 + v 2 vi + v 3 v 4 + vjvs = (8) 
in which vf is the transpose of V[. 

Similarly, let the probabilities of ^j^s; ®a^b an d ®a^b equal to 0, we get 

v\v 2 - v 2 vi + v 3 v 4 - vjv 3 = (9) 
v\v 2 + v\v x - vjv 4 - vjv 3 = (10) 
v\ v 2 - v 2 vi - vjv 4 + vjv 3 = (11) 

From Eqs.(8)-(11), we can obtain 

v\v 2 = v 2 vi = v 3 v 4 = vjv 3 = (12) 



For the same reason, we can obtain the following results: 

(1) Let the probabilities of ^a&b, ^a&b, ^a^b an d equal to 0, we 
can get 

v 1 = or v 3 = 

(14) 

v 2 = or t> 4 = 

(2) Let the probabilities of &a®b an d ^a^b equal to 0, we then have 

vfvi - v 2 v 2 + v 3 v 3 - vjv 4 = (15) 



That is, 




(13) 
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vfvi + v 2 v 2 - vjv 3 - vjvi = 



(16) 



And then 



(17) 

v 2 = ±v 3 

(3) Let the probabilities of ^\^b an d ^a^b equal to 0, we can get the same 
conclusion as Eq.(17). 

Finally, we can obtain three results from Eqs.(13), (14) and (17): 



1. v 1 = v 2 = v 3 = v 4 = ; 

2. vi — V4 — and v 2 = ±^3; 

3. v 2 = v 3 = and v 1 = ±v 4 



That is, each of these results makes Eve succeed in escaping from the detection 
of Alice and Bob. Now we observe what the state \^)abe is by putting these 
results into Eq.(4). If the first result holds, we have \^)abe = 0, which is 
meaningless for our analysis. Consider the condition where the second result 
holds, \<p)abe can be written as: 



|^)abb = (|O1)±|1O))ab®Mi2|0i) 

+ a 2 b 2 2\(p2) + a 3 6 32 10 3 ) + 04642 \^>a))e (18) 

It can be seen that \<p)abe is a product of a two-particle state and the ancilla. 
That is, there is no entanglement between Eve's ancilla and the legal particles, 
and Eve can obtain no information about the key. Similarly, we can draw the 
same conclusion when the third result holds. 

From another point of view, we can derive an effective relation between the 
errors introduced in the key and the information gained by Eve as in Ref.[34]. 
Consider any two EPR pairs on which Alice and Bob will perform ES, for 
example, an d $34, where particles 1, 3 and 2, 4 belong to Alice and Bob 
respectively. As we know, when Alice and Bob make Bell measurements on 
these particles, the marginal statistics of the measurement results are indepen- 
dent of the measurement order. Suppose Alice makes her measurement before 
Bob, the state of 2, 4 will thus be projected onto one of the Bell states 
Because of Eve's intervention, these two particles will be entangled into Eve's 
ancilla and it follows that the state |£) becomes a mixed state p. The informa- 
tion Bob can gain from p is bounded by the Holevo quantity x(p) [33]. Let Isve 
denote the information Eve can obtain, then I Eve < x(p)- (Obviously, Eve can 
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not gain more information about Bob's measurement result than Bob.) From 
x(p)=S(p)-Y,PiS(Pi) (19) 



we know S(p) is the upper bound of x(p)- "High fidelity implies low entropy" 
[34]. Suppose 

F(\o, P ) 2 = mo = i-i (20) 



where is the fidelity [35] of the states |£) and p, < 7 < 1. Therefore, 

the entropy of p is bounded above by the entropy of a diagonal density matrix 
Pmax with diagonal entries 1 — 7, 7/3, 7/3, 7/3. The entropy of p max is 

S( Pmax ) = -(1 - 7) log 2 (l - 7) - 7log 2 I (21) 



Then we have 



I Eve < -(1 - 7) log 2 (l - 7) - 7log 2 
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(22) 



Let us discuss the connection between the fidelity F(\£),p) and the detection 
probability d. When Alice and Bob detect eavesdropping, only |£) is the cor- 
rect result, whereas any other Bell state will be regarded as an error. Since 
F(\0i P) 2 = 1 — 7) t ne detection probability d = 7. From Eq.(22), we get 

IEve < "(1 - d) log 2 (l - d) - d\og 2 1 (23) 



It can be seen from this relation that when d — 0, i.e., Eve introduces no 
error to the key, she will obtain no information, which is in agreement with 
the above result. When 7 > 0, i.e., Eve can gain some of Bob's information, 
but she has to face a nonzero risk d = 7 of being detected. When 7 = 3/4, 
we have S(p max ) = 2, which implies that Eve has the chance to eavesdrop 
on all of Bob's information. In this case, however, the detection probability is 
no less than 3/4 per ES for eavesdropping detection. For example, when Eve 
intercepts all the particles and resends new particles from her own EPR pairs, 
she will get all of the information about Bob's key while introduce 3/4 error 
rate per ES. 

To sum up, our protocol can resist the eavesdropping with ancilla. 
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4 Conclusion 



We have presented a full-efficiency QKD protocol based on ES. The security 
against the attack discussed in Ref. [24] is assured by the technique of RG in- 
stead of requiring alternative measurements [29] or rotations of the Bell states 
[25,26,27]. Furthermore, this technique brings us another advantage. That is, 
it is unnecessary to randomize the initial Bell states as in Refs. [23,25], which 
leads to less Bell measurements in our protocol. For instance, to distribute two 
key bits, Alice and Bob make two Bell measurements in our protocol, while 
in Refs. [23,25] they must make three. 

On the other hand, we have to confess that our protocol has a disadvantage, 
i.e., it uses a sequence of entangled states instead of a single quantum system 
[25,26,27] to generate the key. Nevertheless, it is not a fatal problem. Many 
QKD protocols work in this model, for example, the famous E91 protocol [8]. 
Furthermore, each pair of particles is still in one of the Bell states and can be 
reused in other applications after QKD. 

In practical implementations, our scheme needs complete Bell states analysis. 
Though Bell measurement has not been generally accomplished [36], it was 
experimentally realized based on some certain techniques [37,38,39]. Further- 
more, the realizations of entanglement swapping has been proposed [6,40]. 
Therefore, our scheme is within the reach of current technology. 
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